Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. (CVE-2026-104711)

This vulnerability in Apache Struts involves improper neutralization of special elements in expression language statements, specifically OGNL expressions, when the legacy RESTful action mapper is configured. An attacker can craft a request to inject malicious OGNL expressions, potentially leading to remote code execution. The issue affects multiple version ranges: 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0. Struts 7 versions are only vulnerable if the OGNL allowlist is disabled, which is off by default. Other action mappers such as the default, restful2, or the Struts REST plugin are not affected. The vulnerability is addressed in versions 6.12.0 and 7.4.0.

Successful exploitation can lead to remote code execution without requiring user interaction or privileges, resulting in full compromise of affected systems. The vulnerability has a CVSS 3.1 score of 9.8 (critical), indicating high impact on confidentiality, integrity, and availability.

Users should upgrade affected Apache Struts versions to 6.12.0 or 7.4.0, where this vulnerability is fixed. For Struts 7 users, ensure the OGNL allowlist is enabled (the default setting) to mitigate risk. Applications using the default action mapper, restful2 mapper, or Struts REST plugin are not affected and require no action related to this vulnerability. Patch status is confirmed fixed in the specified versions.